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DOCUMENT- IDENTIFIER: US 5440632 A 

TITLE: Reprogrammable subscriber terminal 



Abstract Text (1) : 

A reprogrammable subscriber terminal of a subscription television service which can 
have the control program code of its control processor modified by downloading new 
program code from the headend. The control processor stores a boot program in an 
internal read only memory. Upon start up and resets, the boot program determines 
whether the control program should be changed from a command sent from the headend. 
The command, termed a parameters transactions, includes the number of expected 
download program code transactions required to complete the control code 
modification, the memory space areas where the code is to be loaded, and the channel 
over which the download program code transactions are to be transmitted. The channel 
is tuned and when the boot program receives all the download program code 
transactions accurately and stores them, the boot program will cause the control 
program to be restarted at a selected address of the new or modified control program 
code which has been downloaded. The boot program may download code to different 
configurations of subscriber terminals including those with Flash EPROM or extended 
memories from plug-in expansion modules. 

Brief Summary Text (6) : 

Currently, these subscriber terminals are controlled by programmable 
microcontrollers which have their control programs stored in a read only memory 
(either integral with the microprocessor or included in a separate integrated 
circuit) or stored in a separate non-volatile memory such as an EPROM or a battery 
backed up RAM. With the current programming methods, the control program of the 
subscriber terminal can only be changed by removing the memory device (or the device 
incorporating the memory) and replacing it. This method is very inconvenient and 
expensive for changes which are to be made to subscriber terminals as it means a 
home visit from the service personnel of the subscription service provider. 
Subscription television systems may have several hundred thousand subscriber 
terminals which may need such upgrades. 

Brief Summary Text (10) : 

The preferred implementation of the subscriber terminal includes a control 
microprocessor which includes at least a read only memory ( ROM ) and random access 
memory (RAM) which is internal to the microprocessor chip. The memory capability of 
the microprocessor additionally includes several pages of Flash EPROM memory in 64k 
blocks which can be mounted internally to the subscriber terminal or externally in 
the form of plug-in modules. The memory space may include other types of memory 
which can be reprogrammed. 

Brief Summary Text (12) : 

In the preferred embodiment, the ROM of the control microprocessor is but a small 
part of the overall memory space of the processor and contains a loader program and, 
optionally, several kernel routines. This system code, collectively termed the boot 
program, is the only part of the memory space which is static and cannot be 
reprogrammed. In an alternative embodiment, the boot program further contains a 
revision number so that the control microprocessor may be upgraded by replacement 
and matched with reprogrammed control program code if so desired. The subscriber 
terminal is adapted to receive a download program code parameters transaction from 
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the headend which describes the new control code which is to be downloaded into the 
memory space of the subscriber terminal. The boot program then utilizes these 
parameters to receive a plurality of download program code transactions which 
contain the program code to be stored. 

Brief Summary Text (17) : 

According to another aspect of the invention, the program code parameters 
transactions define the memory space destination to which the new program code is to 
be downloaded. Conveniently, the memory space may be divided into contiguous areas 
such as a 64k bytes, which physically may be separate integrated circuits. This 
permits selected memory chips to be downloaded rather than the entire memory space. 
This aspect is advantageous when particular types of memory chips are used such as 
Flash EPROM memory which must be entirely erased before being rewritten. With this 
method, only those memory chips which need to be changed are erased. 

Drawing Description Text (10) : 

FIGS. 8A and 8B are a detailed flow chart of the boot program stored in the internal 
ROM of the control microprocessor of the subscriber terminal illustrated in FIG. 2; 

Detailed Description Text (17) : 

The descrambler control 110 of the MCC 104 utilizes recovered descrambling data to 
generate appropriate control signals, for example, inversion control and equalizing, 
sync restoration or regeneration for descrambling, or otherwise restoring the input 
baseband television signal. A secure microprocessor 136 determines whether the 
descrambler control 110 of MCC 104 carries out descrambling on a particular channel 
or what form of descrambling is required at a particular time by interpreting the 
authorization and control data downloaded from the system manager 12 (by any of the 
three data transmission schemes discussed herein, out-of-band, in-band audio or 
in-band video) into the internal NVM memory of the device. The non-volatile memory 
(NVM) in the secure microprocessor 136 stores secure data, for example, 
authorization data, scrambled channel data, scrambling mode data, some terminal 
configuration data and other required data. 

Detailed Description Text (18) : 

The control microprocessor 12 8 operates by running a control program which 
preferably is partially stored in a read-only memory internal to the processor and 
partially stored in a non-volatile memory such as Flash EPROM memory 134. In 
addition, the control program of the control microprocessor 128 may also reside in 
the non-volatile memory of an expansion card 13 8. The microprocessor 12 8 
communicates with the non-volatile memory 134 and 138 via a memory bus 141 which has 
data, address, and control lines. In addition, the microprocessor 128 controls the 
data decoders 117, 129 and 146 and the tuner control 102, volume control 118, on 
screen display control 127, descrambler control 110 and input key scanner and 
control 148 via commands through MCC 104 and control microprocessor bus (CMB) 131. 
The microprocessor 128 also directly controls the mute switch 125 and the output 
frequency selection of the modulator 142. The microprocessor 128 includes additional 
capacity for other auxiliary device communications and control through a data port 
140. 

Detailed Description Text (22) : 

The subscriber terminal may optionally include an impulse pay-per-view (IPPV) module 
of either the telephone type 152 or the RF-IPPV type 154. The IPPV module allows the 
subscribers to request authorization of their subscriber terminal 40 to receive 
pay-per-view events, store the data associated with the purchase of the event in the 
non-volatile memory of the secure microprocessor 13 6, and then transmit the data to 
the system manager 12 via the telephone return path or the RF return path via the 
signal distribution system 52. 

Detailed Description Text (33) : 

The control microprocessor 12 8 generates the page addresses A0-A15 from 2 
bidirectional 8 bit I/O ports PB and PC. The microprocessor 128 time multiplexes the 
port C lines to be both address and data lines AD0-AD7 and applies them to a data 
latch 202 which maintains the address word while it reads data from the same lines. 
The address lines are applied to the address inputs A0-A15 of the internal memory 
134, in FIG. 5 a 256k Flash EPROM (pages 0-3) . Data from the memory 134 is output 
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from its data outputs D0-D7 on the port C data lines AD0-AD7. The extended address 
lines A16 and A17 needed by the memory to address the 64k pages of memory are 
provided by the MCC 104 to determine page assignment. Additionally, the MCC 104 
provides the control signals to the chip enable input *CE, output enable input *OE, 
and write enable input *WE to the memory device 134 . 

Detailed Description Text (34) : 

The microprocessor 12 8 communicates with the MCC 104 over a serial bus with a 
transmit line connected to the address in input ADIN and a receive line connected to 
the address input ADOUT. An address clock on line ACLK provides a clock signal to 
synchronize the transfer of data between the microprocessor 128 and MCC 104. A chip 
select signal ACS is used to select the MCC 104 and to separate control data. The 
MCC 104 also has a connection to the enable output E, and the read/write memory line 
R/W of the microprocessor 128. The MCC 104 further provides a master clock signal 
CLK1 to the XTAL input of the microprocessor 128 to run the device. The MCC 104 
provides a data ready signal INT which is coupled to the interrupt input of 
microprocessor 12 8 to indicate that transaction data has been received and is stored 
in DRAM 137 . 

Detailed Description Text (35) : 

The DRAM 137 is controlled by the memory controller 112 of MCC 104 via address lines 
A0-A9, row address strobe *RAS, column address strobe *CAS, and a write enable 
signal *WE. Data in 4 bit half bytes is read from and written to the data terminals 
D1-D4 of the memory device by the memory controller 112. The output enable input *OE 
and ground input to the DRAM 137 are grounded. The. secure microprocessor 136 
communicates over the secure microprocessor bus (SMB) with the MCC 104. The SMB 
comprises 4 input/output data lines SD0-SD3 and a serial clock line SCLK to time the 
communications. The memory controller 112 additionally provides a master clock CLK2 
to run the secure microprocessor 136. 

Detailed Description Text (38) : 

FIG. 6 illustrates the configuration of the memory space of the control 
microprocessor 128. The space is configured into 64k blocks or pages of memory of 
which there are 16 blocks, 0-15. Each memory block addresses 0000 -FFFF hexadecimal 
and generally is implemented by a single integrated circuit device, either a ROM 
memory, a battery backed up RAM memory, a Flash EPROM memory, or EEPROM memory. This 
address separation makes it easier to control the process of executing the control 
program and enabling the devices. The total memory size in this application may be 
up to 1 megabyte and is configured in this manner for convenience. It is evident 
that additional memory or a different configurations can be made to the memory space 
without varying the invention. 

Detailed Description Text (39) : 

Each memory block has certain reserved spaces for system operation including 
addresses 7000-7FFF hexadecimal (hex) . This partition is used as internal memory 
space to the control microprocessor 12 8 and contains a boot program. Additionally, 
at address 7F7F hex, the code contains the reset address and the revision code 
number of the particular microprocessor and boot program. Addresses 0000-0040 hex 
are reserved for the hardware registers of the control microprocessor 12 8 and the 
memory space 0041-00FF hex is reserved for the internal random access memory of the 
control microprocessor 128. These addresses are unusable in any of the other pages 
and refer only to the internal physical memory space of the control microprocessor 
128. In addition, the 16 memory spaces at the end of each page, FF00-FFFF hex, are 
used to store interrupt vectors and the revision of the present program control 
code. Memory space from 0100-6FFF and 8000 -FEFF hex -is used to provide space for the 
control program of the microprocessor 12 8. This memory space may be downloaded by 
the method described herein. Further, the memory space of these pages may be 
internal (located on a printed circuit board in the subscriber terminal 40) , 
external (supplied on the expansion printed circuit card 138), or both. Any 
combination of types of memory may be used to advantage and the invention should not 
be limited to a particular hardware configuration. Preferably, however, the 
subscriber terminal 40 has 1-16 pages of Flash EPROM memory which can be downloaded 
by the technique herein described. The implementation shown illustrates 4 pages of 
internal Flash EPROM memory with extra pages being mounted externally. The 
additional pages 4-15 can be located on board in plug- in modules or on the expansion 
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card 138. 

Detailed Description Text (40) : 

The control microprocessor 128 contains the boot program in its internal ROM which, 
upon start up or reset, will initialize the subscriber terminal 40 and initiate the 
control program of the control microprocessor 128 from the correct starting address. 
The boot program also provides a loading routine for the downloading of new control 
code, either into the internal non-volatile memory of the subscriber terminal 40, 
such as Flash EPROM memory 134, the external memory on the expansion card 13 8, or 
both. The boot program comprises an initialization and loading program and several 
kernel routines. 

Detailed Description Text (42) : 

After this indication is received, the program will begin a series of tests for its 
physical memory configuration. In block A18 the program will test to determine 
whether there is an expansion card 13 8 present. The test is performed by testing the 
state of the logic signal on port pin PAO of the microprocessor 12 8 which is tied to 
connector 200. If the expansion card is present, then the system parameters of the 
device are set to external values to allow communication with and control of the 
circuitry on the expansion card 138. If it is determined the expansion card is not 
present, then in block A22 the system parameters are set to internal values. With 
this task accomplished, the microprocessor 128 will then select and enable the 
memory configuration which it has determined is present in block A24. In block A26, 
it is determined whether there is external ROM present by checking the configuration 
parameters of the expansion card 13 8. 

Detailed Description Text (43) : 

If there is external ROM present, then the control program will start at the 
external ROM start address in block A2 8. The external ROM start address was a 
parameter which was stored when the system determined that external ROM was present. 
If, however, internal memory is only ROM, then the system will start at the internal 
ROM start address in block A32 . 



Detailed Description Text (44) : 

This permits a facile method of selecting system operation. If external ROM is 
present, this indicates external programming and the subscriber terminal will begin 
executing code there to pass control to the subscriber terminal 4 0 to the external 
module. Different plug-in modules can then provide entirely new features and 
operations of subscriber terminal 40. Unplugging the module will cause failure of 
the test in block A26 and reversion to the internal, software. If there is only 
internal ROM, this indicates there is no space to download program code, and the 
rest of the boot program should not be used. 

Detailed Description Text (45) : 

If neither external ROM nor internal ROM only is present, that means that the system 
should start from an address in the downloadable section of the memory space, in 
which the preferred implementation is Flash EPROM memory. Therefore, the negative 
branch from block A30 will begin a checksum calculation of the Flash EPROM memory, 
both internal and external in block A34. If this checksum calculation is successful 
then in block A38 the system will start from a FLASH system start address. 

Detailed Description Text (46) : 

If, however, the checksum test is failed in block A3 6, the control microprocessor 
128 will determine that program code should be downloaded. The microprocessor 128 
will begin to look for download program code transactions with which to reload the 
Flash EPROM, or other non-volatile memory, of the memory space. This starts in block 
A4 0 by initially coarse tuning the channel with downloadable program code 
information on it. Additionally, a communication (L-l) is displayed in the LEDs of 
the subscriber terminal 40 indicating that the terminal is downloading software. 
Further, a communication to the secure microprocessor is made in block A44 to notify 
it of the present status. Thereafter, in block A46 all flash memory is erased and 
tested in block A48 to determine whether the erasure was successful. If the erasure 
was not successful a loop is formed to try to erase the memory. 



Detailed Description Text (4 9) 
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If, on the other hand, the code revisions do not match then the control 
microprocessor 128 will save the parameters from the transaction in the NVM of the 
secure microprocessor 136 and the DRAM 137. Next, the microprocessor 128 tests to 
determine whether or not the immediate flag is set in block A72 . If the immediate 
flag is set, the system operator has determined that downloading of the code should 
take place at the same time that the parameters transaction is received. This will 
cause the subscriber terminal 40 to go into a downloading mode no matter what else 
the subscriber terminal is doing. If the immediate flag is set the checksum in the 
Flash memory is written incorrectly and the program then jumps to the reset address 
in block A78. By writing the checksum in the Flash memory incorrectly the system 
causes the boot program to start its loading program. 

Detailed Description Text (51) : 

The subscriber convenience flag is not checked until the subscriber terminal is in 
an off mode and then is tested with a block of program incorporated into the other 
off mode function routines. This block of code is more fully illustrated in FIG. 10. 
The program tests the consumer convenience flag in block A80 and if it is not set it 
processes 'the other off mode routines in block A82 before exiting. If the 
convenience flag is set, then in block A84 a message will be displayed to the 
subscriber indicating that "New software is available" and requesting "is it OK to 
update the software (this will take about minutes during which programming will not 
be available)?" Press UP for OK and DOWN for Not OK." The control microprocessor 128 
will then wait for the subscriber key input in block A86, or after a timeout period, 
will accept the lack of a key input as an affirmative response and branch to either 
block A90 or block A94 depending upon the response. If the subscriber does not wish 
the subscriber terminal to be unavailable while the program code is being 
downloaded, then he will select no and then the program will exit in A94 . The 
convenience flag is thereafter tested periodically to determine whether or not the 
downloading can take place. If, however, the subscriber indicates that it is alright 
to download software, the procedure in block A90 writes an incorrect checksum in the 
Flash memory and resets in block A92 . As discussed previously this will cause the 
downloading program of the boot program to activate and download the particular 
program code. 

CLAIMS : 

10. The method of claim 9, wherein said first memory is internal ROM of the 
subscriber terminal . 

11. The method of claim 9, wherein said second memory is at least one of RAM, EPROM , 
and FLASH EPROM memory. 

12. The method of claim 9, wherein said second memory is FLASH EPROM and is divided 
into several pages. 

22. A reprogrammable subscriber terminal as set forth in claim 19 wherein: 

said processor is a microprocessor contained on an integrated circuit and said first 
memory is a read only memory internal to the integrated circuit. 

23. A reprogrammable subscriber terminal as set forth in claim 19 wherein: 
said second memory is at least one of RAM, EPROM, and FLASH EPROM memory. 

24. A reprogrammable subscriber terminal as set forth in claim 19 wherein: 
said second memory has at least a portion which is non-volatile . 

26. A reprogrammable subscriber terminal as set forth in claim 19 wherein: 

said second memory is Flash EPROM and is divided into several pages. 

42. The method of claim 35, wherein said first memory is internal ROM of the 
subscriber terminal . 
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43. The method of claim 35, wherein said second memory is at least one of RAM, 
EPROM, and FLASH EPROM memory. 

44. The method of claim 35, wherein said second memory is FLASH EPROM and is divided 
into several pages. 

56. The reprogrammable subscriber terminal of claim 49, wherein said first memory is 
internal ROM of the subscriber terminal. 

57. The reprogrammable subscriber terminal of claim 49, wherein said second memory 
is at least one of RAM, EPROM, and FLASH EPROM memory. 

58. The reprogrammable subscriber terminal of claim 49, wherein said second memory 
is FLASH EPROM and is divided into several pages. 
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TITLE : Reprogrammable subscriber terminal 

US Patent No. (1) : 
5440632 

Detailed Description Text (12) : 

In the other path, the audio signal is converted from the 41.25 MHz IF carrier to 
the intermodulation frequency of 4 . 5 Hz by a synchronous detector 105. Feedback for 
automatic gain control of detector 105 is supplied from the output of band pass 
filter 131. The audio signal may then be demodulated by an FM demodulator 119. An 
amplitude modulation detector 111 performs pulse detection to recover the in-band 
audio data which are amplitude modulated onto the audio carrier. The recovered 
in-band pulses are supplied to an in-band audio data decoder 117 of MCC 104 for 
processing after being shaped by pulse shaper 115. The in-band data, except for 
descrambling data, is stored in DRAM 137 for buffering. Descrambler control 104 
accesses descrambling data directly for the video descrambling operation. Volume 
control of the audio signal is performed under the control of a volume control 118 
of the MCC 104 and the microprocessor 128 as described in U.S. Pat. No. 5,054,071, 
incorporated herein by reference. After volume control, the audio signal is passed 
through a low pass filter 123 and a mute switch 125. The output of the mute switch 
125 is applied to a modulator 142. 

Detailed Description Text (34) : 

The microprocessor 12 8 communicates with the MCC 104 over a serial bus with a 
transmit line connected to the address in input ADIN and a receive line connected to 
the address input ADOUT. An address clock on line ACLK provides a clock signal to 
synchronize the transfer of data between the microprocessor 12 8 and MCC 104. A chip 
select signal ACS is used to select the MCC 104 and to separate control data. The 
MCC 104 also has a connection to the enable output E, and the read/ write memory line 
R/W of the microprocessor 128. The MCC 104 further provides a master clock signal 
CLK1 to the XTAL input of the microprocessor 12 8 to run the device. The MCC 104 
provides a data ready signal INT which is coupled to the interrupt input of 
microprocessor 12 8 to indicate that transaction data has been received and is stored 
in DRAM 137. 



